UBUNTU-CVE-2026-80225: High severity ubuntu/unbound vulnerability

Q: Which deployments are exposed to this denial-of-service condition?

Unbound deployments that accept TCP or DNS-over-TLS connections are exposed. The affected reading procedure can allow one malicious connection to monopolize a single worker's event loop.

Q: What does an attacker need to do to trigger the issue?

The attacker must be able to connect over TCP or DoT and continuously stream distinct, uncached DNS names. Their write rate must remain ahead of the server's ability to drain the connection.

Q: What is the practical impact on the resolver?

The attack degrades service by consuming a worker's entire event loop for as long as the malicious stream is sustained. The provided data does not indicate confidentiality or integrity impact.

Published Sep 16, 2026

Updated

In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection, monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

Affected Software

5 affected componentsFixes available

ubuntu/unbound<1.9.4-2ubuntu1.11+esm3

1.9.4-2ubuntu1.11+esm3

ubuntu/unbound<1.13.1-1ubuntu5.17

1.13.1-1ubuntu5.17

ubuntu/unbound<1.19.2-1ubuntu3.12

1.19.2-1ubuntu3.12

ubuntu/unbound<1.25.1-1ubuntu3.1

1.25.1-1ubuntu3.1

ubuntu/unbound<1.24.2-1ubuntu2.4

1.24.2-1ubuntu2.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.9.4-2ubuntu1.11+esm3
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.13.1-1ubuntu5.17
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.19.2-1ubuntu3.12
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.25.1-1ubuntu3.1
Upgrade
Upgrade ubuntu/unbound to a version that resolves this vulnerability.
Fixed in 1.24.2-1ubuntu2.4

Event History

Sep 16, 2026

CVE Published

via OSV·09:17 AM

Data Sourced

via OSV·09:17 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

Unbound deployments that accept TCP or DNS-over-TLS connections are exposed. The affected reading procedure can allow one malicious connection to monopolize a single worker's event loop.

What does an attacker need to do to trigger the issue?

The attacker must be able to connect over TCP or DoT and continuously stream distinct, uncached DNS names. Their write rate must remain ahead of the server's ability to drain the connection.

What is the practical impact on the resolver?

The attack degrades service by consuming a worker's entire event loop for as long as the malicious stream is sustained. The provided data does not indicate confidentiality or integrity impact.

UBUNTU-CVE-2026-80225: High severity ubuntu/unbound vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to do to trigger the issue?

What is the practical impact on the resolver?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service condition?

What does an attacker need to do to trigger the issue?

What is the practical impact on the resolver?